[stubs] Fix TypeOfStub to properly return "undefined" for undetectable.

The TypeOfStub didn't test the undetectable bit properly if the instance was also callable, and therefore returned "object" for document.all (which is both undetectable and callable). CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel [email protected] BUG=chromium:567998 LOG=n Committed: https://crrev.com/02cc310370df7e51ac4f705038820066fdfd0cdc Cr-Commit-Position: refs/heads/master@{#32852} Review URL: https://codereview.chromium.org/1527863003 Cr-Commit-Position: refs/heads/master@{#32883}
crosswalk-project · Dec 16, 2015 · fa13da2 · fa13da2
1 parent b742026
commit fa13da2
Show file tree

Hide file tree

Showing 2 changed files with 49 additions and 2 deletions.
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
@@ -396,8 +396,7 @@ HValue* CodeStubGraphBuilder<TypeofStub>::BuildCodeStub() {
               // Is it an undetectable object?
               IfBuilder is_undetectable(this);
               is_undetectable.If<HCompareNumericAndBranch>(
-                  bit_field_masked, Add<HConstant>(1 << Map::kIsUndetectable),
-                  Token::EQ);
+                  bit_field_masked, graph()->GetConstant0(), Token::NE);
               is_undetectable.Then();
               {
                 // typeof an undetectable object is 'undefined'.

diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
@@ -11654,6 +11654,54 @@ THREADED_TEST(CallableObject) {
 }
 
 
+THREADED_TEST(Regress567998) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  Local<v8::FunctionTemplate> desc =
+      v8::FunctionTemplate::New(env->GetIsolate());
+  desc->InstanceTemplate()->MarkAsUndetectable();  // undetectable
+  desc->InstanceTemplate()->SetCallAsFunctionHandler(ReturnThis);  // callable
+
+  Local<v8::Object> obj = desc->GetFunction(env.local())
+                              .ToLocalChecked()
+                              ->NewInstance(env.local())
+                              .ToLocalChecked();
+  CHECK(
+      env->Global()->Set(env.local(), v8_str("undetectable"), obj).FromJust());
+
+  ExpectString("undetectable.toString()", "[object Object]");
+  ExpectString("typeof undetectable", "undefined");
+  ExpectString("typeof(undetectable)", "undefined");
+  ExpectBoolean("typeof undetectable == 'undefined'", true);
+  ExpectBoolean("typeof undetectable == 'object'", false);
+  ExpectBoolean("if (undetectable) { true; } else { false; }", false);
+  ExpectBoolean("!undetectable", true);
+
+  ExpectObject("true&&undetectable", obj);
+  ExpectBoolean("false&&undetectable", false);
+  ExpectBoolean("true||undetectable", true);
+  ExpectObject("false||undetectable", obj);
+
+  ExpectObject("undetectable&&true", obj);
+  ExpectObject("undetectable&&false", obj);
+  ExpectBoolean("undetectable||true", true);
+  ExpectBoolean("undetectable||false", false);
+
+  ExpectBoolean("undetectable==null", true);
+  ExpectBoolean("null==undetectable", true);
+  ExpectBoolean("undetectable==undefined", true);
+  ExpectBoolean("undefined==undetectable", true);
+  ExpectBoolean("undetectable==undetectable", true);
+
+  ExpectBoolean("undetectable===null", false);
+  ExpectBoolean("null===undetectable", false);
+  ExpectBoolean("undetectable===undefined", false);
+  ExpectBoolean("undefined===undetectable", false);
+  ExpectBoolean("undetectable===undetectable", true);
+}
+
+
 static int Recurse(v8::Isolate* isolate, int depth, int iterations) {
   v8::HandleScope scope(isolate);
   if (depth == 0) return v8::HandleScope::NumberOfHandles(isolate);